Bug with fuzz input at bfd_generic_get_relocated_section_contents

David Moreno Montero <[email protected]> Sun, 22 Jul 2012 22:34:13 +0100

Newsgroups	gmane.comp.gnu.utils.bugs
Message-ID	<CAPaXa=0StHC-qTXi-N2cQV8FuygHh3zL1k9ea9mxmSFfPXr2Uw@mail.gmail.com>

Hi,

at the Software Testing 258 at Udacity we were instructed to generate a
fuzzer and try it on a project Fom this work I found gcc (which is caling
ld) to give this output under certain fuzzed files:


/usr/bin/ld: BFD version 2.22.52.0.1-10.fc17 20120131 internal error,
aborting at reloc.c line 6394 in bfd_generic_get_relocated_section_contents
/usr/bin/ld: Please report this bug.


I attach a tar.gz with the .o objects that make it fail, along with a
gcc.sh that allows easy repeat of the message.

I will tidy up my fuzzer code, but nontheless I attach it so you can
improve and/or use it. It can be seen as a ugly proof of concept.

Thanks for the great job you are doing on gnu utils.
-- 
David Moreno Montero

[email protected]
+34 658 18 77 17
+44 74 23 21 01 57
<http://www.coralbits.com/>
http://www.coralbits.com

fuzz.tar.gz (application/x-gzip, 16.9 KB) - not displayed

fuzzer.py (application/octet-stream, 2.8 KB)

#!/usr/bin/python
import os

file_list=[x[:-1] for x in open('files.list').readlines()]

apps = [
        "/usr/bin/gcc",
        ]

fuzz_output = os.path.join(os.path.expanduser('~'),  'src', 'varios', 'st','tst')

log = open('log.txt', 'w')

FuzzFactor = 250
num_tests = 10000
wait_time=0.5

########### end configuration ##########

import math
import random
import string
import subprocess
import time
import shutil

crashlog_src = os.path.join(os.path.expanduser('~'),  'src', 'varios', 'st','DiagnosticReports')
crashlog_dst = os.path.join(os.path.expanduser('~'),  'src', 'varios', 'st','CrashLogs')

crashes = {}
for app in apps:
    crashes[app] = 0

for i in range(num_tests):
    file_choice = ['/home/dmoreno/src/onion/build/examples/hello/CMakeFiles/hello.dir/hello.c.o']+[random.choice(file_list) for x in range(random.randint(2,10))]
    app = random.choice(apps)

    files=[]
    for x in file_choice:
      buf = bytearray(open(x, 'rb').read())
      if len(buf)==0:
        file_list.remove(x)
        continue

      numwrites = random.randrange(math.ceil((float(len(buf)) / FuzzFactor)))+1

      for j in range(numwrites):
          rbyte = random.randrange(256)
          rn = random.randrange(len(buf))
          buf[rn] = "%c"%(rbyte)

      tfuzz_output=os.path.join(fuzz_output,"fuzz."+os.path.basename(x))
      open(tfuzz_output, 'wb').write(buf)
      files.append(tfuzz_output)

    print ' '.join([app,'-o','ftest']+files)
    process = subprocess.Popen([app,'-o','ftest']+files, stderr=subprocess.PIPE)
    stdout=process.stderr.read()
    #
    
    time.sleep(wait_time)
    crashed = process.poll()
    if 'report this bug' in stdout:
      crashed=-256
    
    if not crashed:
        process.terminate()
    elif crashed<0:
        print 'crash!'
        print stdout
        crashes[app] += 1
        log.write('%s crashed (%i), code: %i' % (os.path.basename(app), crashes[app], process.returncode)) #log to text file
        log.write(' '.join([app,'-o','ftest']+files))
        log.write('\n')
        log.write('%s' % stdout)
        for file in os.listdir(crashlog_src):
            src_file = os.path.join(crashlog_src, file)
            dst_file = os.path.join(crashlog_dst, file)
            shutil.move(src_file, dst_file) #move the crashlog (cause only last 20 are saved in DiagnosticReports directory)
        log.write('\n')
        log.write('\n')
        open('%s/gcc.sh'%fuzz_output,'w').write(' '.join([app,'-o','ftest']+files))
        os.system('zip -r crash%i.zip %s > /dev/null'%(crashes[app],fuzz_output))
        time.sleep(30)
        #open(('%s crash%i.log' % (os.path.basename(app), crashes[app])), 'wb').write(buf) #write file which crashed the app for further investigation
    for x in files:
      try:
        os.remove(x)
      except:
        pass
        
log.close()
print 'Finished'